Network node devices with limited resources often need to authenticate an external device, such as a network server, to perform a critical function. For example, a node device may want to provide private data, such as a measurement, location or ID information, to a system that is authorized to receive it.
One prior approach provides a node with a method to seek permission from an authority, or trusted controller, within a network. For example, the node may create a unique message and send that message to the trusted controller for the system, where the controller might sign the unique message and return it to the node. When the node verifies the signature for the message it can continue assuming it was granted authority by the trusted controller.
Also known are algorithms for controlling different levels of access (or permissions) on the host entity. Each level is related to a private-public key pair. The ability to offer multiple access levels with a single key offers an advantage in limiting the storage of multiple keys on an embedded system.
Also known are solutions that use communication protocols where the device encrypts the challenge message and the server calculates a digital signature and returns it to the device. This approach requires the device to support multiple mathematical functions, including elliptic curve point multiplications and finite field inversions. An additional approach encrypts a challenge message which is restricted to contain a random component plus the message. The server can decrypt the message and return the random part of the challenge message unencrypted. This approach resolves the simplicity issue, but then the level of security is compromised if the system needs a large percentage of the message to be the private information rather than a random value.
It is well known that data can be encrypted and then decrypted by utilizing a pair of keys, one of which is public and one of which is private. The keys are mathematically related such that data encrypted using the public key can be decrypted using the private key. It is also well known that a signature created with the private key can be verified utilizing the public key, and that anyone without the private key cannot generate a signature that will be validated.
The most well-known public key cryptosystems are those based on integer factorization and discrete logarithms in finite groups. It is also well known that by using computations in an elliptic curve defined over a finite field rather than a RSA cryptosystem, it is possible to achieve an increased security level for the same key size or, conversely, the same security level for a shorter key compared with the RSA cryptosystem.
Thus, elliptic curve encryption schemes are very suitable for the embedded environment, as the key sizes are much smaller than in the widely-used RSA schemes and require less memory.
In an elliptic curve based, public-key encryption scheme, there are a number of system parameters that must be shared by all participants in order to make the scheme work. The set of system parameters typically consists of the definitional terms of the elliptic curve to be used, as well as a designated generator point P, represented by x- and y-coordinates, known as affine coordinates. The elliptic curve defining parameters are typically designated a and b, where the group of points on the elliptic curve is defined by the group Ep(a,b) for which y2=x3+ax+b, modulo p or the group E2m(a,b) for which y2+xy=x3+ax2+b, modulo 2m. The parameter p or m (which defines the finite field of definition) is also part of the set of system parameters. The elliptic curve may also be defined in terms of projective coordinates X, Y and Z. The curves are then defined by the group Ep(a,b) for whichY2Z=X3+aXZ2+bZ3, modulo p,or the group E2m(a,b) for whichY2Z+XYZ=X3+aX2Z+bZ3, modulo 2m.
The affine and projective coordinates are related by x=X/Z and y=Y/Z.